Supporting CSIRTs in the EU Marco Thorbruegge Head of Unit Operational Security European Union Agency for Network and Information Security

Transcription

1 Supporting CSIRTs in the EU Marco Thorbruegge Head of Unit Operational Security European Union Agency for Network and Information Security European Union Agency for Network and Information Security 1

2 Agenda o Who is ENISA? o EU Policy context o Examples of ENISAs work o Threat Landscape o Cyber Europe Exercises o Support for EU CSIRTs o Fight against Cybercrime o Baseline capabilities for national CSIRTs o Capability building training o ENISA and the CSIRT communities European Union Agency for Network and Information Security 2 2

3 Who is ENISA European Union Agency for Network and Information Security 3 3

4 Who is ENISA Operational Office in Athens Seat in Heraklion European Union Agency for Network and Information Security 4

5 EU Policy Context European Union Agency for Network and Information Security 5

6 EU Policy context EU Digital Agenda COM(2010)245 EU Cyber Security Strategy JOIN(2013)1 European Union Agency for Network and Information Security 6

7 Agenda o Who is ENISA? o EU Policy context o Examples of ENISAs work o Threat Landscape o Cyber Europe Exercises o Support for EU CSIRTs o Fight against Cybercrime o Baseline capabilities for national CSIRTs o Capability building training o ENISA and the CSIRT communities European Union Agency for Network and Information Security 7 7

8 Examples of other work: Security Landscape Report links: European Union Agency for Network and Information Security 8

9 The ENISA Threat Landscape (ETL) Helps understanding the threats and threat sources It is Based on Open Source Intelligence (OSINT) Contains information about current threats and threat trends ENISA projects threats to important ICT areas/ sectors/ assets TA1 TA2 Asset TA3 ETL Scope TA Threat Agent T Threat Vulnerability Measure TA4 The exposure of assets to threat European Union Agency for Network and Information Security 9

10 Evolution in threats landscape Trends Phishing Targeted attacks (e.g. Stuxnet) Botnets Drive-byexploits Worms /Trojans Computer virus Spying Spam Time European Union Agency for Network and Information Security 10

11 European Union Agency for Network and Information Security 11

12 Examples of other work: Cyber Security Exercises European Union Agency for Network and Information Security 12

13 EU Cybersecurity Strategy Achieving Cyber Resilience The Commission asks ENISA to: Assist the Member States in developing strong national cyber resilience capabilities, notably by building expertise on security and resilience of industrial control systems, transport and energy infrastructure Continue supporting the Member States and the EU institutions in carrying out regular pan-european cyber incidents exercises which will also constitute the operational basis for the EU participation in international cyber incidents exercises. European Union Agency for Network and Information Security 13

14 Cybersecurity Exercises by ENISA Cyber Europe 2010 Europe s first multinational cybersecurity exercise between public sector agencies Joint EU-US Cybersecurity Exercise 2011 First transatlantic cooperation exercise Table-top exercise - what-if scenarios Cyber Europe 2012 Large scale realistic cyber-crisis exercise Public and private sectors involved Cyber Europe 2014 In planning phase Joint EU-US Cybersecurity Exercise 2014/ In planning phase European Union Agency for Network and Information Security 14

15 European Union Agency for Network and Information Security 15

16 Agenda o Who is ENISA? o EU Policy context o Examples of ENISAs work o Threat Landscape o Cyber Europe Exercises o Support for EU CSIRTs o Fight against Cybercrime o Baseline capabilities for national CSIRTs o Capability building training o ENISA and the CSIRT communities European Union Agency for Network and Information Security

17 The situation in Europe (Status 02/2014) ESTABLISHED IN 2005: SITUATION IN 2014: Finland France Germany Hungary The Netherlands Norway Sweden United Kingdom Austria Belgium Bulgaria Croatia Czech Republic Denmark Estonia Finland France Germany Greece Hungary Iceland Ireland Italy Latvia Lithuania Luxembourg Malta Netherlands Norway Poland Portugal Romania Slovakia Slovenia Spain Sweden Switzerland United Kingdom EU Institutions We are building and actively supporting a growing network of national/governmental CERTs CERT Interactive MAP: European Union Agency for Network and Information Security 17

18 CERT and other operational communities 1. Baseline capabilities support 2. Capability building via training and good practice 3. Cooperation in the fight against cybercrime European Union Agency for Network and Information Security 18

19 Agenda o Who is ENISA? o EU Policy context o Examples of ENISAs work o Threat Landscape o Cyber Europe Exercises o Support for EU CSIRTs o Fight against Cybercrime o Baseline capabilities for national CSIRTs o Capability building training o ENISA and the CSIRT communities European Union Agency for Network and Information Security

20 Supporting CERTs to collaborate with law enforcement o Cybercrime is global and not a sectorial problem o Calls for cross-border and cross-sector collaboration o ENISAs role is to foster cooperation o Among CERTs o CERTs and other stakeholders o ENISA s work in this field o Support CERT/LEA Cooperation European Union Agency for Network and Information Security

21 The Fight against Cybercrime European Union Agency for Network and Information Security

22 ENISA-EUROPOL/EC3 joint workshops Closed meeting - by invitation only Cybercrime topics Organised together with Europol/EC3 Workshops (so far) include: ENISA training (Identifying and handling cyber-crime traces cooperation in the area of cybercrime) Round-table discussions Creating opportunities for new contacts between communities Organised on annual basis and European Union Agency for Network and Information Security

23 Agenda o Who is ENISA? o EU Policy context o Examples of ENISAs work o Threat Landscape o Cyber Europe Exercises o Support for EU CSIRTs o Fight against Cybercrime o Baseline capabilities for national CSIRTs o Capability building training o ENISA and the CSIRT communities European Union Agency for Network and Information Security

24 CERT capabilities 1.Formal capabilities (mandate; definition of roles and responsibilities, ) 2. Operational-technical capabilities (provided services) 3.Operational-organisational capabilities (working format; host organisation; business continuity, ) 4.Co-operational capabilities (national level, crossborder, regional, different partners) European Union Agency for Network and Information Security 24

25 Baseline capabilities - MANDATE (Mandate / official framework covers the powers and justification that need to be granted to the team by the respective government) National cyber security strategy (-> n/g CERT role specified) recommended a CERT needs to act in the right framework Official mandate by the government in place must - to represent the country in the CERT communities Duties, roles and responsibilities defined must - Official national Point of Contact (PoC) for CERTs and other members of the security community recommended clarify status quo with regards to the relevant NIS key players in a country and their relationship must be taken into account when the mandate for the n/g CERT is formulated. CERT of last resort function recommended (in case of doubt and emergency, the team is available to relay incident reports (and other security related information) to the right stakeholders in its country. Suitable organizational model recommended to carefully evaluate the role of n/g CERTs in governmental structure to decide which sector, ministry, agency or other structure is the most appropriate place for the CERT in the particular country European Union Agency for Network and Information Security 25

26 Baseline capabilities SERVICE PORTFOLIO (Service portfolio covers the services that a team provides to its constituency or is using for its own internal functioning) Core services must do Incident handling, analysis and reporting Secondary services recommended Alerts and Warnings and Announcements for the constituency in a both reactive and proactive way. Additional services recommended - Sharing of security related information on alerts and warnings in immediate cases of upcoming threats or other emergencies. Internal functioning services recommended - Constant situation awareness by technology watch, training and exercises. Further develop service portfolio. European Union Agency for Network and Information Security 26

27 Baseline capabilities OPERATIONAL (Operational capabilities covers technical and operational requirements a team must comply with) Resources must 3-5 FTE initially; minimum 6-8 FTE for 24/7 reachability Communication minimum telephone, team address and website with incident reporting option must - role and responsibility of a n/g CERT is clearly communicated to all relevant stakeholders, national and in international level. Reachability must 24/7 for own constituency and inter/national cooperation partners for responding to NIS incidents. Physical security must be able to secure sensitive information (needs further clarifications). European Union Agency for Network and Information Security 27

28 Baseline capabilities COOPERATION (Cooperation capabilities subsumes the requirements with regards to information sharing with other teams, that are not covered by the previous three categories) Trust and trust building minimum personal knowledge and reputation of team members. recommended Trust criteria (technical expertise with a proven track record, membership in CERT initiatives, ability to respond quickly and act on security threats and a stable team, etc. Needs further clarification!) National and international cooperation minimum a key role (driver) on the national level; must - PoC role for the international cooperation Informal groups recommended membership in fora like FIRST and TI Common terminology and schemes recommended to follow national and international best practices European Union Agency for Network and Information Security 28

29 Agenda o Who is ENISA? o EU Policy context o Examples of ENISAs work o Threat Landscape o Cyber Europe Exercises o Support for EU CSIRTs o Fight against Cybercrime o Baseline capabilities for national CSIRTs o Capability building training o ENISA and the CSIRT communities European Union Agency for Network and Information Security

30 Tier 1: Good Practice Guides for CERTs European Union Agency for Network and Information Security 30

31 Tier 2: Training material available European Union Agency for Network and Information Security 31

32 Tier 3: Training for national / governmental CERTs ENISA starts to rollout its own training! First: May 2013 in Bucharest, Romania 3 scenarios presented by ENISA trainers Honeypots Incident handling during an attack on Critical Information Infrastructure Mobile threats incident handling Since then: more than 15 events on request by the EU MS European Union Agency for Network and Information Security 32

33 Tier 3: Training for national / governmental CERTs Trainers come on-site! Each training is tailored to fulfil the needs of this specific event and audience! Other trainings (TRANSITS) can be organised! Hands on class with virtual images More info: cert-relations@enisa.europa.eu European Union Agency for Network and Information Security 33

34 Agenda o Who is ENISA? o EU Policy context o Examples of ENISAs work o Threat Landscape o Cyber Europe Exercises o Support for EU CSIRTs o Fight against Cybercrime o Baseline capabilities for national CSIRTs o Capability building training o ENISA and the CSIRT communities European Union Agency for Network and Information Security

35 Content regularly updated and renewed with the help of community The creation process of material involves community The target audiences feedback will lead to better material European Union Agency for Network and Information Security 35

36 Community Support European CERT Community Meetings 3x a year Teams Accreditation & Certification Worldwide CERT Community Yearly Conference Regular Technical Colloquia Fundamental training Organisation, Operations, Legal, Communication European Union Agency for Network and Information Security

37 CERT and other operational communities European Union Agency for Network and Information Security 37

38 European Union Agency for Network and Information Security (ENISA) Follow us on Contact details European Union Agency for Network and Information Security